It’s no secret that the 2008 financial crisis revealed enormous holes in our banking system’s risk management. But since then a lot of things have changed.
LWA | Image Bank | Getty Images
Businessman failure
After giving banks free rein in the period that led up to the financial crisis, regulators are now doing their best to make up for their former lax oversight. They’ve forced banks to hold more capital, boost the amount of cash they’ve got available for unforeseen market blowups, and even test the vulnerability of their businesses to events beyond their control.
Bankers say their risk cultures and internal controls have changed significantly since the crisis. All of the biggest banks have spent significant money on sprucing up systems to deliver the kind of data and analysis that Fed stress tests require. They say they’re going beyond the Fed’s mandates and have dramatically increased their own stress testing.
We decided to ask the experts if this was true. We polled a couple dozen equity analysts who cover Bank of America , Citigroup , Goldman Sachs , JPMorgan Chase and Morgan Stanley .
We gave five factors to rate on how these companies manage risk. We got comprehensive answers from a third of them. We decided to turn the results into a report card. We also asked a few separate questions on what matters the most in risk management. Below are the results.
Our first question was direct: Who’s the best risk manager on Wall Street? Hands down the answer was Goldman Sachs.
“If you said, ‘I just landed from the future and this is what is going to unfold over the next couple of years and some companies are not going to survive and some companies are going to pick up share, and do much better on a relative basis,’ you wouldn’t have gotten all of them right, but you definitely would have had Goldman and JPMorgan on this side, and it is because of their risk managements,” said Glenn Schorr, analyst at Nomura.
We also asked who had the worst risk management. That came up with a tie — between Bank of America, Citigroup and Morgan Stanley.
(Read More: Biggest Risk Management Debacles.)
We asked the analysts to assess the risk management at these firms based on the strength of their risk culture, whether they hold their traders to strict trading limits, how good they are at managing their own complexity and business focus, the strength of their capital ratios and their liquidity.
Here are the results:
Once again Goldman is at the top of the list, and is perceived to have the strongest risk culture. Its $175 billion liquidity cushion helps, as does its strict limits on trading.
It’s the industry consensus that risk management is deeply encoded in the Goldman DNA. It carries over from the days of the partnership, when every executive at the firm had their personal wealth on the line.
One former exec told CNBC a story that has become legend at Goldman, where risk reports to the chief financial officer. Goldman did a major overhaul of its risk systems in 1994 when the survival of the partnership was threatened by massive losses from a wrong way bet on interest rates. Around that time, David Blood, then CFO of Europe, put the kibosh on a trade by a UK trader. The trader threatened Blood with losing his job. The spat was escalated up the chain to Stephen Friedman, at that time chairman of the executive committee. Friedman delivered the following message personally to the trader: “If you ever say that to one of our controllers again, YOU’ll be fired.”
While the retirement of CFO David Viniar — who held that position during the entire time since the firm went public — is a loss to the firm, analyst Schorr said the structure of the risk management organization is so strong that the firm will not miss a beat when Harvey Schwartz takes over.
What had rival bankers griping.
In the analyst survey, Goldman is fairly closely followed by JPMorgan Chase — the Whale debacle notwithstanding. (Read More: 'London Whale' Was Urged to Boost Valuations: Report.)
Rival bankers griped at this. But analysts said overall its liquidity was second to none, and its risk culture was strong. It also got fairly high marks for its capital hoard and sticking to its guns on trading limits. This last may seem ironic given that the losses at the CIO came because traders were allowed to run amok. But one of the first things JPMorgan did to fix the problem: Introduce granular trading limits at the CIO, which the firm acknowledged as a risk management failure.
Morgan Stanley comes in third, with liquidity its strongest suit. The firm has invested a lot in its risk systems since trader Howie Hubler lost $9.5 billion on one trade in 2007.
“Morgan Stanley has a long way to improve,” said CSLA analyst Mike Mayo. “Over the last decade they hired employees when they should have fired them, they fired employees when they should have hired them, they zigged when they should have zagged. And they are still trying to get the formula correct."
But Mayo has a lot of time for CEO James Gorman. Mayo published a report upgrading the stock in mid-July that also said Gorman should be sacked for the stock performance. About ten minutes after publishing the report, Mayo got a message that Gorman had called. He returned the call with some trepidation, but when Gorman picked up, the first words out of his mouth were “That wasn’t very nice!”
“It completely broke the ice,” Mayo said.
What followed was an intelligent discussion of Gorman’s efforts to turn the company around, and the time he has spent on cleanup. Mayo said it didn’t change his thesis at the time, but the conversation showed Gorman is “listening to investors on how to create shareholder value.”
Bank of America comes in fourth, just ahead of Citigroup. Analysts say both institutions are paying for their history of acquisitions. That has created legacy systems that have been difficult to coordinate. Analysts generally give Citigroup a lot of credit for investing in streamlining its systems, and shedding risky assets. Bank of America also gets kudos for slimming down, but analyst Schorr says on the systems side, it’s still playing catch-up.
(Read More: Weighing Risk: Not Sexy, But It Matters.)
The analyst who has the biggest bone to pick with Citigroup is Mike Mayo. He sees Citigroup’s failure to acknowledge a negative say on pay vote by changing its compensation hurdles for CEO Vikram Pandit as a risk management issue.
“The CEO sets the tone at these big banks,” Mayo said.
Citigroup has said that its chairman Michael O’Neill is following a board mandated process for addressing the say on pay vote which occurred at this year’s annual meeting. The process involves talking to lots of shareholders.
“I think it’s fair enough for the company to say, ‘Time out, you realize he made zero the year before and zero the year before that,'” said Nomura’s Schorr. “He didn’t create this mess. He came in to try and help fix it.”
—By CNBC's Margaret Popper, with reporting by CNBC's Kate Kelly
@popperm, @KateKellyCNBC